Feeds

Cellular network hijacking for fun and profit

The Reg cut-out-and-keep guide

Secure remote control for conventional and virtual desktops

Weekend Following the success of hijacked network Free Libyana, we took the opportunity to talk to some engineers about the complexity of lifting someone else's infrastructure, and discovered there isn't much.

In April this year, Ousama Abushagur hacked into the infrastructure built by the Libyana network in Libya.

He cut the connections to the head office in Tripoli to create his own operator, Free Libyana, connecting 750,000 people without putting up a single transmitter mast and funded entirely from donations. It was certainly an admirable achievement, but not one that's as technically complicated as it first appears – if you have local knowledge, and an army, on your side.

We spoke to network engineers at three of the UK's operators, to see how difficult they thought it would be to hijack their own infrastructure, and were uniformly told that it wasn't very hard at all.

The key requirement is knowledge of the existing topology, ideally with passwords and key phrases, but it seems that with the minimum of knowledge one can subvert great chunks of someone else's network infrastructure, and even take the customers too, as long as you're not hoping to run a 3G network and don't mind forsaking much of the security inherent in the GSM standard.

Not that one can just waltz up to a base station and take control – at least not without being noticed, as the networks are highly monitored. Disconnecting any base station will "light up [the office] like a bloody Christmas tree" as one engineer eloquently put it, which is fine if you're behind your own lines, with a battle front between you and the network engineers dispatched to see what's going on. Try it in other circumstances and you'll have a white van parked beside you within the hour.

But we're assuming you do have a popular uprising on your side, or that the engineers have more important things to do than monitor the outlying regions of their own network. Networks try to have a decentralised topology, but still generally end up with one location from where everything is controlled (though they'll generally have a fallback location too). If that location is disconnected, destroyed or otherwise engaged, then the field is open for a rogue network to set up operations.

Setting up a mobile network isn't particularly difficult – several companies make backpack-sized mobile networks that can be up and running within a few minutes. Such devices generally have a range of a few hundred yards, and their own backhaul via satellite dish.

The pack shown is from Altobridge and includes the MSC (Mobile Switching Centre), HLR (Home Location Registry), and BTS (Base Transceiver Station – the actual radio on 2G systems) as well as a suitable antenna, and satellite dish to haul the calls somewhere useful. You need to negotiate a downlink and some satellite time, and issue SIM chips to everyone making use of it, but as the range is only a few hundred yards that shouldn't present a problem.

Such solutions are eminently portable, but won't connect up the existing population, so taking over what's already there makes more sense if it can be done.

Initially one can take the portable rig and strap the antenna to a nearby mast, but it would be more sensible to plug the portable kit into an existing BTS to make use of the controller, radio and antenna which someone has thoughtfully abandoned. That should just be a matter of plugging everything in, with reasonably standard connections and communications it will give you one working base station for your new network.

Even better is to find a local BSC (base station controller). This rack-mounted kit will control a handful of BTS locations all of which can be recruited from a single BSC. The older models of BSC have no security at all, our engineers reckoned you could plug in your portable network, hit the reset switch, and be up and running in moments – though that is when the Christmas tree effect kicks in.

Now you've got a BSC, but you'll want to know where the nearby base station controllers are so you can get them powered up too, which is where knowledge of the local topology is so important.

5 things you didn’t know about cloud backup

More from The Register

next story
UK fuzz want PINCODES on ALL mobile phones
Met Police calls for mandatory passwords on all new mobes
Canadian ISP Shaw falls over with 'routing' sickness
How sure are you of cloud computing now?
Don't call it throttling: Ericsson 'priority' tech gives users their own slice of spectrum
Actually it's a nifty trick - at least you'll pay for what you get
Three floats Jolla in Hong Kong: Says Sailfish is '3rd option'
Network throws hat into ring with Linux-powered handsets
Fifteen zero days found in hacker router comp romp
Four routers rooted in SOHOpelessly Broken challenge
New Sprint CEO says he will lower axe on staff – but prices come first
'Very disruptive' new rates to be revealed next week
PwC says US biz lagging in Internet of Things
Grass is greener in Asia, say the sensors
Ofcom sees RISE OF THE MACHINE-to-machine cell comms
Study spots 9% growth in IoT m2m mobile data connections
O2 vs Vodafone: Mobe firms grab for GCHQ, gov.uk security badge
No, the spooks love US best, say rival firms
Ancient pager tech SMS: It works, it's fab, but wow, get a load of that incoming SPAM
Networks' main issue: they don't know how it works, says expert
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.